Peer benchmarking is comparing your metrics against those of similar organizations. Boards ask for it constantly, usually phrased as a version of how do we compare to our peers.
The question is reasonable. The available answers are weaker than they appear, and it is worth being straight about why.
Vendor-published studies drawn from their own customer base, which is a sample of organizations that bought that product.
Industry body surveys, which are self-reported and self-selected.
Consultancy benchmarks, typically drawn from engagements, which skew toward organizations that hired a consultancy.
External security ratings, which measure what can be observed from outside and do not see the internal programme at all.
None of these are worthless. All of them describe a population that is not your peer group in the sense the board means.
Even with a perfect sample, contributors compute differently.
Two organizations report remediation time. One counts from discovery, one from ticket creation. One excludes accepted risks from the denominator, one does not. One covers internet-facing systems only.
The published figures differ by a factor of two and neither is performing differently. See benchmark.
This is structural rather than a flaw in any particular study, and it is why a peer figure should frame a discussion rather than set a target.
Your own trend, which uses a definition you control and hold constant. It answers whether the organization is improving, which is the question underneath the peer question most of the time.
A regulatory or framework expectation, which is a defined standard rather than an average of unknown practices. In banking and energy in particular, the supervisory expectation is a firmer reference point than any peer study.
An agreed protection level, which converts the comparison question into a funding question with an owner. See PLA.
Carry its caveats with it. Sample size, collection date, how the metric was defined, how it was normalized.
A benchmark quoted without its footnotes will be repeated back to you eventually, usually in a setting where the footnotes matter.
From the blog